Security researcher Nightmare Eclipse published a proof-of-concept exploit on September 8, 2026, demonstrating that Microsoft's September Patch Tuesday update did not fully close the ShieldBreak vulnerability (CVE-2026-69414) in the Microsoft Malware Protection Engine. According to the researcher's publication, the new exploit, named ShieldCrash, achieves arbitrary file read as NT AUTHORITY\SYSTEM on Windows 11 25H2 and Windows Server 2025 with the September engine update 1.1.26080.3 installed.

The researcher stated Microsoft fixed several exploitation paths for ShieldBreak but missed a specific condition that still allows the same underlying race condition to be triggered. The PoC is described as a basic version; the researcher indicated it may later be developed into a full SYSTEM-level exploit. Microsoft's advisory for CVE-2026-69414 acknowledges an elevation of privilege in the Malware Protection Engine and recommends keeping malware definitions and the engine updated automatically.

Confirmed

  • ShieldCrash PoC released September 8, 2026, by Nightmare Eclipse (Chaotic Eclipse / INFINITE NIGHTMARE / MSNightmare).
  • Targets CVE-2026-69414 (ShieldBreak), an elevation-of-privilege flaw in the Microsoft Malware Protection Engine (mpengine.dll).
  • Achieves arbitrary file read as SYSTEM on Windows 11 25H2 and Windows Server 2025 with September 2026 patches installed.
  • Microsoft Malware Protection Engine version 1.1.26080.3 (September 2026) does not block the exploit.
  • Exploit requires Windows Defender to be enabled and actively scanning; endpoints with Defender disabled or a different registered AV are not affected.
  • Attack chain: local code execution foothold required; not a remote unauthenticated vulnerability.
  • Microsoft advisory confirms elevation of privilege in the Malware Protection Engine; recommends automatic engine and definition updates.
  • CISA Binding Operational Directive 26-04 gives federal agencies 14 days to mitigate after CVE assignment (August 14, 2026).

Unknown

  • Whether Microsoft will issue an out-of-band engine update or wait for the October Patch Tuesday cycle.
  • Full scope of affected Windows versions beyond 11 25H2 and Server 2025; Windows 10 and its Server equivalents reportedly share the underlying flaw but are not officially targeted by the public PoC.
  • Whether the basic arbitrary-file-read PoC will be extended to a reliable arbitrary-code-execution-as-SYSTEM weapon.
  • Independent replication of the 100% success rate claimed by Nightmare Eclipse for ShieldBreak against Canary channel builds.
  • Real-world exploitation activity since the PoC release.

Our take

Three public bypasses in three months — RoguePlanet, ShieldBreak, now ShieldCrash — show Microsoft's engine patches are not holding. The Malware Protection Engine's cloud-file hydration and CLFS/Object Manager surface appears fundamentally difficult to harden without architectural changes. Defenders should treat "Defender enabled" as an exposure factor until a patch survives independent testing; the Tanium phoneinfo.dll placeholder and Qualys patchless remediation are the only immediate controls.

Sources